Remote-friendly Senior Security Engineer — SIEM, IAM & AI

Vivid; United States; Remote; USD 160,000 - 230,000; Full time

Benefits offered by this job

Learning & development budget

Fully paid vacation and sick leave

Sports compensation

Job summary

Vivid is seeking a Security Engineer to own and improve the security of our cloud-native environment, including identities, SaaS apps, endpoints, and AI tooling. This hands-on senior role requires designing controls, closing gaps, and building automation to scale security across the company.

You will lead detection engineering and incident response with SIEM, manage IdP posture, enforce least privilege, and drive cross-team security initiatives while communicating clearly to engineers and

Qualifications

• 5+ years in security operations, corporate/IT security, or endpoint engineering.
• Strong with a SIEM (Splunk, Elastic, Panther, Sumo Logic) — detection engineering and incident response — plus an identity provider (Okta, Entra ID, Google Workspace), access recertification, and least-privilege / PAM.
• Working knowledge of endpoint security (MDM, XDR/EDR/AV) and email / phishing defense.
• Practical experience securing how a company uses AI internally: shadow AI discovery, DLP for AI tools, controls for AI assistants and agents, and a working risk framework for adopting new ones.
• You’ve done this for real, not from a vendor pitch deck.
• Strong scripting and automation skills — you build tooling against APIs, not just configure consoles.
• Track record of driving improvements end‑to‑end and leading initiatives with little oversight.
• Clear written and spoken English for engineers and leadership.

Responsibilities

• Own SIEM alerting end‑to‑end: ship logs from endpoints, IdP, VPN, SaaS, and cloud; write and tune detection rules; cut false positives.
• Act as first responder for security incidents — investigate, contain, drive to closure with clear runbooks — and feed recurring issues back into preventive controls.
• Administer the IdP (SSO via SAML/OIDC, MFA, conditional access) and run access recertification end‑to‑end across IdP, SaaS, AWS, and internal tools — scope, evidence, follow‑through on revocations.
• Hunt down over‑permissive and stale access, enforce least privilege and PAM, catch SoD gaps, and make JML and third‑party access work in practice.
• Improve SaaS security posture (Google/Microsoft, Slack, GitHub, others) and apply DLP controls to limit data leakage.
• Keep the endpoint stack healthy and well‑tuned — MDM, XDR/AV, device‑compliance checks for VPN/ZTNA — and define posture requirements (disk encryption, EDR present, OS version) with automated remediation.
• Defend against phishing and spoofing — secure email gateway rules, DMARC/SPF/DKIM — and run phishing simulations and security awareness, acting on the results.
• Build internal tooling and automate repetitive operations — reduce manual work, don’t just operate it.
• Own the roadmap for your areas: identify gaps, lead initiatives independently, and raise the bar rather than just maintain it.

Skills

SIEM expertise

Incident response

Okta / Entra

PAM / least privilege

Scripting & Automation

English communication

Tools

Splunk

Elastic

Panther

Sumo Logic

Okta

Entra ID

Google Workspace

Job description

Vivid is seeking a Security Engineer to own and improve the security of our cloud-native environment, including identities, SaaS apps, endpoints, and AI tooling. This hands-on senior role requires designing controls, closing gaps, and building automation to scale security across the company.

You will lead detection engineering and incident response with SIEM, manage IdP posture, enforce least privilege, and drive cross-team security initiatives while communicating clearly to engineers and